Paper/Archive/CVE-2026-0542

CVE-2026-0542

ServiceNow ServiceNow AI Platform — Remote Code Execution in ServiceNow AI Platform

CVSS 9.2 (CNA)9.2 / 10 × 3027.6 Not in CISA KEV+300.0 EPSS percentile 51.8.518 × 2010.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.

Affected

ProductAffectedFixed inSource

ServiceNow AI Platform< AustraliaAustraliaCNA

ServiceNow AI Platform< Zurich Patch 5Zurich Patch 5CNA

ServiceNow AI Platform< Zurich Patch 4 Hot Fix 3bZurich Patch 4 Hot Fix 3bCNA

ServiceNow AI Platform< Yokohama Patch 12Yokohama Patch 12CNA

ServiceNow AI Platform< Yokohama Patch 10 Hot Fix 1bYokohama Patch 10 Hot Fix 1bCNA

ServiceNow AI Platform< Xanadu Patch 11 Hot Fix 1aXanadu Patch 11 Hot Fix 1aCNA

Scores by source

SN (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2693566